shiro相关Filter
0前言
shiro中的filer是使用servlet中的filter接口扩展的，但是shiro代理了servlet 原生的filter，请求到了后会先执行shiro的filter，再执行原生的filter。
前面文章项目启动时shiro加载过程中介绍过，shiro只配置了shiroFilter一个拦截器入口，那么shiro是怎样执行内部那么多filter的？shiro内部访问控制filter又是如何实现的呢？
带着上述两个问题，我们梳理下shiro的filter实现和工作流程。
filter看翻译是过滤器的意思，但是经常有人把它翻译成拦截器，SpringMVC 中的 Interceptor才是拦截器。我也经常搞错，但是这里我们严谨亿点点。
1shiro的filter实现
这里照搬一下zhangkaitao博客中的图。
（1）Filter
servlet的filter，不熟悉的可以看一下servlet规范。
（2）AbstractFilter
shiro实现，主要用来配置FilterConfig，init（）方法里提供了一个模板方法onFilterConfigSet（）供子类实现。
（3）NameableFilter
给filter起名字的，如shiro自带的anon、authc，名字要求唯一，不然会有问题。
（4）OncePerRequestFilter
用于防止多次执行 Filter 的；也就是说一次请求只会走一次过滤器链；另外提供 enabled 属性，表示是否开启该过滤器实例，默认 enabled=true 表示开启，如果不想让某个过滤器工作，可以设置为 false 即可。可以简单看一下dofilter实现，源码107行
public final void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws ServletException, IOException { String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();
//首先检查一下有没有执行过这个filter，通过在request里面设置attribute实现 if ( request.getAttribute(alreadyFilteredAttributeName) != null ) { log.trace("Filter '{}' already executed. Proceeding without invoking this filter.", getName()); filterChain.doFilter(request, response); } else //noinspection deprecation
//在判断一下这个过滤器需不需要执行enable属性为true才需要执行 if (/* added in 1.2: */ !isEnabled(request, response) || /* retain backwards compatibility: */ shouldNotFilter(request) ) { log.debug("Filter '{}' is not enabled for the current request. Proceeding without invoking this filter.", getName());
//不需要执行就到过滤器链的下一个过滤器 filterChain.doFilter(request, response); } else { // Do invoke this filter... log.trace("Filter '{}' not yet executed. Executing now.", getName()); request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE); try {
//重点，shiro的过滤器都走这个逻辑，这是一个模板方法，具体实现交给子类实现 doFilterInternal(request, response, filterChain); } finally { // Once the request has finished, we're done and we don't // need to mark as 'already filtered' any more. request.removeAttribute(alreadyFilteredAttributeName); } } }
OncePerRequestFilter算是一个比较重要的Filter实现，shiro的所有filter只有这一次dofilter实现。OncePerRequestFilter子类分成了两个分支：
一个是AdviceFilter，shiro内部授权和验证的filter实现都是在这一分支。
一个是AbstractShiroFilter，也就是web.xml中配置的shiro入口filter。
下面先分析一下AdviceFilter这条线路
（5）AdviceFilter
该类提供了Filter的Aop风格支持，类似于 SpringMVC 中的 Interceptor：
//在过滤器执行链前执行，异常会中断过滤器链后续执行（类似于aop的前置增强）
boolean preHandle(ServletRequest request, ServletResponse response) throws Exception
//在过滤器执行链后执行（类似aop的后置增强） void postHandle(ServletRequest request, ServletResponse response) throws Exception
//最终执行，可以用于资源清理（类似于aop的后置最终增强） void afterCompletion(ServletRequest request, ServletResponse response, Exception exception) throws Exception;
前面说过OncePerRequestFilter的dofilter调用了一个模板方法doFilterInternal，AdviceFilter正是通过实现doFilterInternal实现类似aop功能，AdviceFilter类源码124行
public void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain) throws ServletException, IOException { Exception exception = null; try { //执行前置增强逻辑 boolean continueChain = preHandle(request, response); if (log.isTraceEnabled()) { log.trace("Invoked preHandle method. Continuing chain?: [" + continueChain + "]"); }
//前置增强器正常返回才会继续执行过滤器链后续 if (continueChain) { executeChain(request, response, chain); }
//执行后置增强器 postHandle(request, response); if (log.isTraceEnabled()) { log.trace("Successfully invoked postHandle method"); } } catch (Exception e) { exception = e; } finally {
//cleanup里面调用了afterCompletion方法 cleanup(request, response, exception); } }
（6）PathMatchingFilter
PathMatchingFilter 提供了基于 Ant 风格的请求路径匹配功能及过滤器参数解析的功能.。
PathMatchingFilter重写了父类AdviceFilter的preHandle方法，PathMatchingFilter类源码163行
protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
//appliedPath就是配置中指定的需要拦截的url if (this.appliedPaths == null || this.appliedPaths.isEmpty()) { if (log.isTraceEnabled()) { log.trace("appliedPaths property is null or empty. This Filter will passthrough immediately."); } return true; } for (String path : this.appliedPaths.keySet()) {
//处理请求的路径匹配需要拦截的路径 if (pathsMatch(path, request)) { log.trace("Current requestURI matches pattern '{}'. Determining filter chain execution...", path); Object config = this.appliedPaths.get(path); return isFilterChainContinued(request, response, path, config); } } //no path matched, allow the request to go through: return true; }
主要执行的内容交给isFilterChainContinued，PathMatchingFilter类源码192行
private boolean isFilterChainContinued(ServletRequest request, ServletResponse response, String path, Object pathConfig) throws Exception {
//isEnabled判断这个过滤器生不生效，这里会调用OncePerRequestFilter的实现 if (isEnabled(request, response, path, pathConfig)) { //isEnabled check added in 1.2 if (log.isTraceEnabled()) { log.trace("Filter '{}' is enabled for the current request under path '{}' with config [{}]. " + "Delegating to subclass implementation for 'onPreHandle' check.", new Object[]{getName(), path, pathConfig}); }
//重点要关注的方法 return onPreHandle(request, response, pathConfig); } if (log.isTraceEnabled()) { log.trace("Filter '{}' is disabled for the current request under path '{}' with config [{}]. " + "The next element in the FilterChain will be called immediately.", new Object[]{getName(), path, pathConfig}); } //This filter is disabled for this specific request, //return 'true' immediately to indicate that the filter will not process the request //and let the request/response to continue through the filter chain: return true; }
onPreHandle方法处理匹配路径时需要处理的过滤器逻辑，PathMatchingFilter这里默认返回true，主要交给子类实现。
AnonymousFilter，也就是配置里的anon，就是实现PathMatchingFilter，我们可以看到anon的onPreHandle方法啥也没干（没有拦截逻辑），直接返回true。
public class AnonymousFilter extends PathMatchingFilter { /** * Always returns <code>true</code> allowing unchecked access to the underlying path or resource. * * @return <code>true</code> always, allowing unchecked access to the underlying path or resource. */ @Override protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) { // Always return true since we allow access to anyone return true; } }
（7）AccessControlFilter
AccessControlFilter 提供了访问控制的基础功能，比如是否允许访问/当访问拒绝时如何处理等。
这是比较重要的过滤器实现，shiro自己内部访问控制Filter都是基于该Filter实现，我们自己定义的Filter也可以直接扩展该类，（不需要复杂访问控制逻辑自定义Filter也可以直接扩展PathMatchingFilter ）
AccessControlFilter重写了父类PathMatchingFilter的onPreHandle方法，相当于该过滤器的入口。AccessControlFilter类源码161行。
public boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception { return isAccessAllowed(request, response, mappedValue) || onAccessDenied(request, response, mappedValue); }
isAccessAllowed方法返回true表示通过访问控制验证，否则才会执行后面的onAccessDenied，onAccessDenied表示访问拒绝时需要执行的逻辑。
isAccessAllowed和onAccessDenied都是需要子类扩展的。这里以authc为例看看怎么实现的。authc表示FormAuthenticationFilter。
FormAuthenticationFilter继承AuthenticatingFilter，AuthenticatingFilter又继承AuthenticationFilter，最后AuthenticationFilter继承AccessControlFilter
首先isAccessAllowed实现
//AuthenticatingFilter第121行
@Override protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { return super.isAccessAllowed(request, response, mappedValue) || (!isLoginRequest(request, response) && isPermissive(mappedValue)); }
//AuthenticatingFilter父类AuthenticationFilter第79行，判断有没有登陆
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
Subject subject = getSubject(request, response);
return subject.isAuthenticated();
}
如果登陆了，直接返回true，否则看看是不是请求的登陆url或者配置了许可的请求，满足其一就返回true
然后是onAccessDenied实现
onAccessDenied没有那么多弯弯道道，直接由FormAuthenticationFilter实现，源码148行
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
//如果请求路径是登陆请求，有没有显示的配置loginUrl，没有的话默认/login.jsp
if (isLoginRequest(request, response)) {
//登陆请求必须是post的 if (isLoginSubmission(request, response)) { if (log.isTraceEnabled()) { log.trace("Login submission detected. Attempting to execute login."); }
//执行login逻辑，这里用户可以不用自己写登陆入口，前提是需要配置loginUrl return executeLogin(request, response); } else { if (log.isTraceEnabled()) { log.trace("Login page view."); } //allow them to see the login page ;) return true; } } else { if (log.isTraceEnabled()) { log.trace("Attempting to access a path which requires authentication. Forwarding to the " + "Authentication url [" + getLoginUrl() + "]"); } //其他请求会保留现场，并重定向到登陆页面 saveRequestAndRedirectToLogin(request, response); return false; } }
下面看一下authc的登陆实现executeLogin，源代码AuthenticatingFilter类第44行
protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception { AuthenticationToken token = createToken(request, response); if (token == null) { String msg = "createToken method implementation returned null. A valid non-null AuthenticationToken " + "must be created in order to execute a login attempt."; throw new IllegalStateException(msg); } try { Subject subject = getSubject(request, response); subject.login(token);
//登陆成功后会重定向到登陆前请求的页面，successUrl只是个备选重定向地址 return onLoginSuccess(token, subject, request, response); } catch (AuthenticationException e) {
//失败的话会在request的attribute里面记录失败异常，请求会继续回到当前页 return onLoginFailure(token, e, request, response); } }
若不是登陆请求saveRequestAndRedirectToLogin则会存下request，并重定向到登陆页面loginUrl
如果不想用shiro提供的登陆逻辑呢。而且现在项目基本都是前后端分离，使用异步请求，路由的逻辑一般都会交给前端处理，重定向不是那么友好。
我想到的有三个思路：
1）第一个是authc不拦截登陆url
自己在controller里实现登陆的逻辑，但是authc拦截器会拦截其他的url，没有登陆的话请求后端其他接口还是会重定向到loginUrl。
这里后端可以配一个假的loginUrl，重定向到“前端host/noauth”，然后前端要起一个代理服务打到“后端服务/noauth”，后端response返回一个401给前端，前端接收到401响应自己路由到登陆页面。
这样的话前端要起一个代理服务，并且后端还是重定向了，只能说没有走authc的executeLogin。可以但是没有必要
2）自定义扩展AccessControlFilter
可以参考FormAuthenticationFilter实现，没有认证时不重定向，直接response设置401即可。授权模块的AuthorizationFilter就是这么做的，参考源码AuthorizationFilter类106行
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws IOException { Subject subject = getSubject(request, response); // If the subject isn't identified, redirect to login URL if (subject.getPrincipal() == null) { saveRequestAndRedirectToLogin(request, response); } else { // If subject is known but not authorized, redirect to the unauthorized URL if there is one // If no unauthorized URL is specified, just return an unauthorized HTTP status code String unauthorizedUrl = getUnauthorizedUrl(); //SHIRO-142 - ensure that redirect _or_ error code occurs - both cannot happen due to response commit: if (StringUtils.hasText(unauthorizedUrl)) { WebUtils.issueRedirect(request, response, unauthorizedUrl); } else { WebUtils.toHttp(response).sendError(HttpServletResponse.SC_UNAUTHORIZED); } } return false; }
配置了unauthorizedUrl就走重定向逻辑，没有配置就直接返回response 401
3）干脆不用shiro的访问控制Filter
自己写一个Filter或者实现SpringMVC 中的 Interceptor，自己做登陆拦截或者权限拦截也很nice
到此，我们回答了一个问题：shiro内部访问控制filter又是如何实现的
这些Filter都没有配置到web.xml，spring也没有显示处理这部分filter配置。那么这些filter是如何生效的，我们知道web项目唯一配置的Filter是ShiroFilter，
也许我们可以从shiro Filter的另一个实现分支AbstractShiroFilter中找到答案。
2shiro的Filter工作流程
先看入口ShiroFilter，shiroFilter只是提供了init方法的实现，用于绑定SecurityManager和FilterChainResolver，主要的功能还是在其父类AbstractShiroFilter实现的。
AbstractShiroFilter直接继承了OncePerRequestFilter，所以我们还是从模板方法doFilterInternal突破，请求会到这里来，源代码AbstractShiroFilter第350行。
protected void doFilterInternal(ServletRequest servletRequest, ServletResponse servletResponse, final FilterChain chain) throws ServletException, IOException { Throwable t = null; try {
//HttpServletRequest会被包装为ShiroHttpServletRequest final ServletRequest request = prepareServletRequest(servletRequest, servletResponse, chain);
//HttpServletResponse会被包装为ShiroHttpServletResponse final ServletResponse response = prepareServletResponse(request, servletResponse, chain);
//为没有请求/响应对创建一个WebSubject实例，这个实例会在整个请求响应执行过程中使用 final Subject subject = createSubject(request, response); //noinspection unchecked subject.execute(new Callable() { public Object call() throws Exception {
//更新session访问时间，只会管理shiro自己的session（HttpSession不会管）
//通过调用session.touch()实现 updateSessionLastAccessTime(request, response);
//执行过滤器逻辑 executeChain(request, response, chain); return null; } }); } catch (ExecutionException ex) { t = ex.getCause(); } catch (Throwable throwable) { t = throwable; } if (t != null) { if (t instanceof ServletException) { throw (ServletException) t; } if (t instanceof IOException) { throw (IOException) t; } //otherwise it's not one of the two exceptions expected by the filter method signature - wrap it in one: String msg = "Filtered request failed."; throw new ServletException(msg, t); } }
next
//源代码AbstractShiroFilter第446行
protected void executeChain(ServletRequest request, ServletResponse response, FilterChain origChain) throws IOException, ServletException {
//注意，这里会代理FilterChain FilterChain chain = getExecutionChain(request, response, origChain); chain.doFilter(request, response); }
//源代码AbstractShiroFilter第406行
protected FilterChain getExecutionChain(ServletRequest request, ServletResponse response, FilterChain origChain) {
FilterChain chain = origChain;
//获取初始化时注入的FilterChainResolver
FilterChainResolver resolver = getFilterChainResolver();
if (resolver == null) {
log.debug("No FilterChainResolver configured. Returning original FilterChain.");
return origChain;
}
//重点，生成代理的FilterChain
FilterChain resolved = resolver.getChain(request, response, origChain);
if (resolved != null) {
log.trace("Resolved a configured FilterChain for the current request.");
chain = resolved;
} else {
log.trace("No FilterChain configured for the current request. Using the default.");
}
return chain;
}
源代码PathMatchingFilterChainResolver类第93行
public FilterChain getChain(ServletRequest request, ServletResponse response, FilterChain originalChain) {
//（1）FilterChainManager维护了shiro默认Filter和用户自定义Filter，
//还维护了filterChains表示用户配置的pathPattern到多个filter的对应关系 FilterChainManager filterChainManager = getFilterChainManager(); if (!filterChainManager.hasChains()) { return null; } String requestURI = getPathWithinApplication(request); //the 'chain names' in this implementation are actually path patterns defined by the user. We just use them //as the chain name for the FilterChainManager's requirements for (String pathPattern : filterChainManager.getChainNames()) { // If the path does match, then pass on to the subclass implementation for specific checks:
//如果请求路径和pathPattern匹配 if (pathMatches(pathPattern, requestURI)) { if (log.isTraceEnabled()) { log.trace("Matched path pattern [" + pathPattern + "] for requestURI [" + requestURI + "]. " + "Utilizing corresponding filter chain..."); }
//代理原生的FilterChain return filterChainManager.proxy(originalChain, pathPattern); } } return null; }
这里说明下FilterChainManager 中维护的filterChains，表示用户配置的pathPattern到多个filter的对应关系。pathPattern是用户配置的url，如/login、/role/*等，filter表示这些路径请求需要执行的过滤器如authc、anon等。
下面跟进filterChainManager是如何代理的，
//源代码DefaultFilterChainManager类第318行
public FilterChain proxy(FilterChain original, String chainName) { NamedFilterList configured = getChain(chainName); if (configured == null) { String msg = "There is no configured chain under the name/key [" + chainName + "]."; throw new IllegalArgumentException(msg); }
// return configured.proxy(original); }
//源代码SimpleNamedFilterList类，第78行
public FilterChain proxy(FilterChain orig) {
return new ProxiedFilterChain(orig, this);
}
最终找到了代理类ProxiedFilterChain
public class ProxiedFilterChain implements FilterChain { //TODO - complete JavaDoc private static final Logger log = LoggerFactory.getLogger(ProxiedFilterChain.class); private FilterChain orig;
//filters表示本次请求路径匹配的pathPattern对应的所有Filter private List<Filter> filters; private int index = 0; public ProxiedFilterChain(FilterChain orig, List<Filter> filters) { if (orig == null) { throw new NullPointerException("original FilterChain cannot be null."); } this.orig = orig; this.filters = filters; this.index = 0; } public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException { if (this.filters == null || this.filters.size() == this.index) { //we've reached the end of the wrapped chain, so invoke the original one: if (log.isTraceEnabled()) { log.trace("Invoking original filter chain."); }
//如果匹配到shiro的Filter为空，或者匹配到shiro的filter都执行完了，才会执行servlet原本的Filter逻辑 this.orig.doFilter(request, response); } else { if (log.isTraceEnabled()) { log.trace("Invoking wrapped filter at index [" + this.index + "]"); }
//这里开始一个个按顺序执行shiro自己的Filter逻辑 this.filters.get(this.index++).doFilter(request, response, this); } } }
这就是ShiroFilter整个代理执行过程。
